Privacy policy

SkeinVault is a small tool for keeping track of your own yarn. It was built for one household and a handful of invited friends. There are no adverts, no tracking, no analytics, and nothing is sold to anybody.

What is stored

The yarn you enter yourself: brands, yarns, colours and dye lots — including the lot number, how many balls, how much is left, and what a lot is set aside for if anything. One photograph per colour, if you take one. And your email address, because that is what you sign in with.

And if something goes wrong in the app, one line about the error: what went wrong, which screen it happened on, which version of the app was running, and which browser you were using. It exists so the error can be fixed without you having to remember what it said. It holds nothing about your yarn, and the lines are cleared out over time.

Where it lives

Your data is inside the EU. The database and the photographs are with Supabase in Frankfurt, and they do not leave the EU.

The website itself — the files your browser fetches in order to draw the page — is with Microsoft Azure, and is copied to servers around the world so that the page loads quickly wherever you are. There is nothing about you in those files. They are the same for everybody.

Patterns sent by mail

Mail to the address you can forward patterns to is received by Postmark, a company in the United States, which keeps it for up to 45 days. The app keeps the mail's subject, sender and text and its PDF attachments with your patterns for a month, unless you add one as a pattern — then that PDF becomes a pattern like any other. The mail's text is read by an AI service at Microsoft Azure in the EU to see whether it contains a pattern.

Who can see it

You, and the administrator. As far as every other user is concerned your yarn is yours alone: there is no sharing between users, not even read-only, and no other user can see your stash. The administrator — the person who grants access — can open your stash so that they can help you when something goes wrong.

Photographs of labels

When you photograph a label, the picture is sent out of the app to a service outside the EU that reads the text on it and proposes what it says. That service deletes its copy within 30 days, and that copy is the one thing here we cannot delete for you. Our own copies stay in the EU: the picture of the back, the one with the lot number, is read and thrown away, and the picture of the front is kept with your colour if you want it kept.

Nothing read off a photograph is ever saved without you seeing it first.

Photographs of the yarn

When you save a colour photograph of a ball, the picture is sent to Replicate, a company in the United States, which cuts the yarn out of its background and sends the result back. Replicate deletes the picture and the result within an hour. What is kept with us is the picture without its background — or the picture as taken, if you choose that.

Signing in

You sign in with your Google account. The app sees your email address and your name and asks for nothing else. It never sees your password and does not store one — there is no password here at all.

You can also sign in with a six-digit code that Postmark sends to your email address. The code works for an hour, and only once.

Invitations and access

You can only get in if you have been invited. The administrator adds your Google account to the list, and can remove it again.

Every invitation and every removal is recorded permanently: the address, whether it was an invitation or a removal, when it happened, and who did it. That record cannot be edited or deleted by anybody, including the administrator. It exists because it is the only thing that can answer "was I removed, or is the app having a bad day?", and from the sign-in screen those two look identical. It holds nothing about anybody's yarn.

If your access is removed while you are signed in, the app locks you out within about an hour. Your yarn is not touched.

How long it is kept

For as long as you keep using the app.

If you want it deleted

Write to the address below and it will be deleted — your yarn, your photographs and your account. Two things remain: the lines in the invitation record above, which nobody can delete, and whatever copy of a label photograph the reading service still holds. That one is not ours to reach, but it goes of its own accord within 30 days.

What the app does not do

It does not send email. It uses no analytics or tracking tools. It shares nothing with anybody. It does not talk to Ravelry or any other yarn site. The only thing sent to another service is the label photograph described above.

Cookies and what the browser remembers

The app keeps your sign-in session in the browser so you do not have to sign in every time. That is all. There are no analytics or advertising cookies.

Contact

Write to dpo@afroditevej5.dk. Google's sign-in screen shows a different address — it is the same person. Google only allows the account the app was created with.

Last changed 2026-10-16.